PT-2026-51233 · Craft Cms · Cms

Gcxwlp · Published 2026-06-21 · Updated 2026-06-21 · CVE-2026-56385

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.9.13 Craft CMS versions 4.0.0-RC1 through 4.17.7

Description An authorization bypass exists in the 'assets/preview-file' endpoint. The system fails to enforce per-asset view authorization before returning preview content. This allows an authenticated low-privileged user to provide a controlled assetId for an asset they are not permitted to view and receive preview response data (previewHtml), which includes a private preview image route containing the target private assetId.

Recommendations Update Craft CMS versions 5.0.0-RC1 through 5.9.13 to version 5.9.14. Update Craft CMS versions 4.0.0-RC1 through 4.17.7 to version 4.17.8. As a temporary workaround, restrict access to the 'assets/preview-file' endpoint to authorized users only.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-56385

Affected Products

Cms

References · 5

• https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27 · Patch
• https://github.com/craftcms/cms/security/advisories/GHSA-44px-qjjc-xrhq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56385 · Security Note
• https://vulncheck.com/advisories/craft-cms-authorization-bypass-in-assets-preview-file-endpoint · Note
• https://twitter.com/VulmonFeeds/status/2068713419335721214 · Twitter Post